Skip to main content

External identity provider

XClarity One uses internal identity-management systems to authenticate local users. You can choose to set up federation using your company’s existing identity providers (IDPs) to provide seamless access to the XClarity One portal using corporate credentials without the need for additional user-account creation or management, while maintaining strong identity and access management practices.

To configure an external IDP for your organization, click Federated authentication in the context menu of the Settings view, click the Add icon (Add icon) on the top-right corner and follow the steps in the wizard.
Note

  • To add additional IDPs, click the Add icon (Add icon) again on the top-right corner.

  • When an IDP is removed, corporate users in the IDP that also exist in other organizations will not be removed.

After XClarity One is set up to use your external IDP, sign-in requests from the XClarity One portal are redirected to your external IDP for authentication, based on the email domain for the user. After the user is authenticated, the web browser is redirected back to the XClarity One portal.

Attention
A DNS server must be configured before configuring an external IDP. If you set up XClarity One portal to use DHCP for IP addresses, but the DHCP server does not provide a DNS server (this is uncommon), then configuring the external IDP might fail. In this case, manually configure the DNS server on the Network settings page before configuring the external IDP (see Portal network). Note that changing the network configuration requires you to restart the virtual machine, which can take several minutes.

Protocols​

You can configure XClarity One portal to use a federation IDP that supports OIDC/OAuth, SAML, and LDAP protocols. If your identity provider is not currently supported, open a service ticket using the Submit an eTicket webpage.

Tip
After you set up an external IDP, you cannot edit the protocol. If you need to change the protocol, remove the configuration by clicking Remove from the Federated authentication card, and then click the Add icon (Add icon) to reconfigure the external IDP.
OIDC/OAuth and SAML

The following IDPs are supported.

  • Amazon Cognito IAM

  • Auth0 (by OKTA)

  • Google Cloud IAM

  • Microsoft Entra ID

  • OKTA

  • OneLogin

  • Ping One (by Ping Identity)

You can provide the URL where the configuration information can be downloaded from your IDP or you can import the IDP configuration file from the local system. The file must be in JSON format for OIDC/AUTH and XML format for SAML.

Note

  • For SAML, ensure that subject NameID in the IDP is set as emailAddress (for example, rn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress).

  • The external IDP is set up based on your company’s email domain. If your company has multiple organizations that use the same email domain, the external IDP is available to all organizations with the same domain.

  • When setting up Microsoft Entra ID as an external IDP using SAML:

    1. Copy the Redirect information and SP Entity ID from XClarity One and paste it as the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) in the Entra ID app.

    2. Copy the App Federation Metadata Url from the Entra ID app and paste it as the URL for IDP configuration in XClarity One .

    3. Copy the attributes under Attributes & Claims from the Entra ID app and paste it to the corresponding mapping attributes fields in XClarity One.

LDAP
LDAP is supported only when running XClarity One on premises. The following IDP is supported.

  • Microsoft Active Directory

Attention

  • Ensure that email addresses are unique for all users.

  • LDAP users must sign in using their userPricinipleName. Ensure that all LDAP user accounts that will have access to XClarity One have userPrincipalName set in Active Directory.

  • After configuring LDAP, you must manually create LDAP user groups in XClarity One that match the user-group names defined on the LDAP server. XClarity One uses these user groups to determine which users are allowed to sign in. For more information (see User groups).

Provide the following information.

  • Host/FQDN. Hostnames or FQDNs for one or more LDAP servers, separated by a comma.

  • Port. Port used by the LDAP server

    If you choose to use secure LDAP (SSL), port 636 is used by default.

    If you choose to use insecure LDAP (non SSL), port 389 is used by default.

    You can also specify a global catalog server port: 3269 (SSL), or 3268 (non SSL).

  • Enable SSL. When enabled, the connection uses SSL (Secure LDAP) for secure, encrypted communication. You must provide the full certificate chain for the LDAP server. The certificate chain does not need to be signed by a well-known certificate authority.

    Attention
    When disabled, the connection uses non-SSL (Insecure LDAP) without encryption, which might expose sensitive data during transmission. Use insecure LDAP only in trusted, secure network environments.

  • Bind DN/Username. User account to use for LDAP authentication to bind XClarity One to the LDAP server. Specify the fully-qualified LDAP distinguished name (for example, cn=somebody,dc=company,dc=com) or email address (for example, somebody@company.com).

    The distinguished name must be a user account within the domain that has at least read-only privileges.

    If the bind fails, the authentication process also fails.

  • Bind password. Password for secure LDAP authentication

  • Base user DN. Fully-qualified LDAP distinguished name from which LDAP client initiates the search for users (for example, dc=company,dc=com)

    This value must comply with the distinguished-name guidelines defined by RFC2253.

Important

When an LDAP server is removed, all LDAP user groups in XClarity One that belong to that LDAP server is removed.

Multi factor authentication​

XClarity One requires multi-factor authentication to prevent malicious attacks in the XClarity One portal within your organization and across organizations. If multi-factor factor authentication is not already set up in your federation identity provider, XClarity One will handle it for you.

Local vs corporate users​

User administrators can manually add users to their organization using the portal’s local identity-management system. These are called local users.

Users that sign in using an identity provider are referred to as corporate users.

When an external (corporate) identity provider other than LDAP is configured, user accounts are not created automatically. You must manually add each IDP user to XClarity One and assign the appropriate roles.

When the organization is configured to use an LDAP server, XClarity One uses LDAP user groups to determine which users are allowed to sign in. You must manually create LDAP user groups in XClarity One that match the user-group names defined on the LDAP server. XClarity One automatically creates user accounts for users who sign in through LDAP and belong to one or more of the matching user groups. For more information about LDAP user groups, see User groups.

If an external IDP is configured to use a specific email domain, non-organization owners with that domain can be created in and signed in only through that external IDP. Email domains that are used by an external IDP cannot be used for local users other than organization owners.

Note
After your company’s external IDP is set up for your organization, local users might also have a corporate user account in the external IDP that uses the same email address. When a user with both local and corporate accounts signs in for the first time, they are prompted to link the two accounts. Non-organization owners can only sign in through the corporate IDP after linking. Organization owners, however, can choose to authenticate using either their local or corporate account. If you initially choose to use your corporate account but later wish to switch to your local account, you can do so by clicking the link to sign in locally on the sign-in page.

  • When using the XClarity One cloud portal, an email is sent to you to link your corporate and local user accounts.

  • When using XClarity One on premises and SMTP is not configured, the web interface prompts you to sign in again using your credentials and one-time passcode to link your corporate and local user. Otherwise, an email is sent to you to link the accounts.

After signing in to the corporate IDP, corporate users can access the XClarity One portal without providing additional credentials. In addition, XClarity One requires multifactor authentication by providing a one-time passcode (OTP) from an authenticator application that is connected to XClarity One.

If the corporate IDP is disabled or removed, all corporate users are disabled. Users with local user accounts can still sign in using local XClarity One credentials.